Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
51314 analyzed
7403 re-analysis due
996 not analyzable
0 not yet analyzed
4850 source gone
not analyzable
796 too large 200 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 369
- committed secret 6298
- dynamic exec 12011
- obfuscation 3650
- suspicious endpoint 12542
- credential in log 718
- over-broad oauth scope 2556
- suspicious skill script 197
- bundled IDE extension 50
- skill file 190167
- HIGH dynamic exec r33drichards/mcp-js setTimeout(string)
setTimeout("logger('ONE')", 100); - HIGH dynamic exec r33drichards/mcp-js vm exec
const foreignObject = vm.runInNewContext('({"foo": ["bar", "baz"]})'); - HIGH dynamic exec r33drichards/mcp-js new Function()
[{ fn: new Function('') }, 'fn=', { 'fn': '' }], - HIGH dynamic exec r33drichards/mcp-js indirect eval
runInNewContext(code) { return (0, eval)(code); }, - HIGH dynamic exec AgentVerify/agentverify eval()/exec()
value = eval("1 + 1") - HIGH obfuscation slee1996/pillowfort dynamic require()/import()
const helper = await import(`../client/src/services/roomInvitation.ts?capture-case=${++captureCase}`) as typeof InvitationModule; - HIGH obfuscation paulchrisluke/krabiclaw dynamic require()/import()
const { formatCalendarDate, formatTimestamp } = await import(${JSON.stringify(timezoneUrl)}); - MEDIUM suspicious endpoint paulchrisluke/krabiclaw www.google-analytics.com (telemetry)
`https://www.google-analytics.com/mp/collect?measurement_id=${encodeURIComponent(measurementId)}&api_secret=${encodeURIComponent(apiSecret)}`, - HIGH credential in log paulchrisluke/krabiclaw credential in log
console.log(`Password: ${localDeveloperPassword}`) - HIGH committed secret mshobeyri/multimeter private key
PEM private key block (redacted) - HIGH committed secret mshobeyri/multimeter private key
PEM private key block (redacted) - HIGH committed secret mshobeyri/multimeter private key
PEM private key block (redacted) - HIGH committed secret mshobeyri/multimeter private key
PEM private key block (redacted) - HIGH committed secret mshobeyri/multimeter private key
PEM private key block (redacted) - HIGH committed secret mshobeyri/multimeter private key
PEM private key block (redacted)